Method and apparatus for frame peeking

ABSTRACT

A system for frame peeking at a node of a data network includes a controller, a forwarding engine and an interface. The interface includes a subscribe/publish interface for allowing the controller to request (or subscribe) to receive a selected portion of a flow (a group of packets), and a facility access interface for allowing the controller to control each frame or packet. By providing only a selected portion of received packets to the controller rather than the entire packet, the controller can operate on the incoming data without significantly degrading the forwarding performance of the system. Frame peeking can also be used in an end-system to minimize packet processing.

BACKGROUND OF THE INVENTION

The present invention relates to data networks, and more particularly,to a method and apparatus for peeking at a portion of a frame or packetrather than the full packet.

Computer networks can be managed using a variety of techniques.Increasingly, it is becoming more desirable to actively manage computernetworks, for example, to provide consistent service quality. However,in order to actively manage computer networks in an effective manner,systems must typically operate in the data path. In other words, systemsmust operate on the data packets to be forwarded. However, by operatingon the packets to be forwarded, added delay is introduced in the packetforwarding process which can exacerbate network congestion.

FIG. 1 illustrates a system 10 located at a node of a data network. FIG.1 illustrates an example of a system that operates in the data path.System 10 includes a controller 12 for controlling the operation ofsystem 10, a forwarding engine 14 for forwarding packets received online 18. Packets are output (forwarded) via line 20. Controller 12 andforwarding engine 14 can communicate via interface lines 16. Congestionis a common problem in data networks. Congestion occurs when there ismore data to be carried over the network than the network can support.

There are several congestion control techniques that can be used todecrease network congestion. One common technique used to decreasenetwork congestion is to discard packets. Because some packets have ahigher priority or a greater importance than other packets, it maydesirable to selectively discard certain packets over others. However,each of the packets must be analyzed to determine whether the packetshould be discarded or forwarded.

Referring to the system of FIG. 1, a group of packets are input toforwarding engine 14 via line 18. The received packets are stored in abuffer 15 and then routed via path 21 to controller 12. At theapplication level, the packets can be analyzed by controller 12 todetermine which packets should be discarded and which packets should beforwarded. The packets can be analyzed based upon application semantics.The packets are then each copied back to buffer 15 of forwarding engine14 for forwarding on line 20.

While this selective discard technique can decrease congestion and lossin utility due to congestion, this technique can also increase the delayin the forwarding process. The critical forwarding path of the networkis the data path which is input on line 18 and is output on line 20. Asignificant delay is introduced by moving each of the packets along path21 from buffer 15 of forwarding engine 14 to the controller 12 and thenback to buffer 15. This delay is very significant because the interfacebetween controller 12 and forwarding engine 14 has a very limitedbandwidth.

Moreover, in an Asynchronous Transfer Mode (ATM) network, controller 12operates on application level frames, which can include many ATM cells.Therefore. in an ATM network, the ATM cells received on line 18 musttypically be reassembled into application level frames. After the cellsare reassembled into an application level frame, controller 12 can thenanalyze the data to determine whether the cells should be discarded orforwarded. The application level frame must then be segmented back intothe separate ATM cells before moving the individual cells back to buffer15 in forwarding engine 14. This reassembly and segmentation processfurther slows the forwarding task that must be performed by system 10.

System 10 of FIG. 1 can improve reception quality during congestion byoperating in the data path to selectively discard less important packetsand forward more important packets. However, this is done at the priceof a significant delay incurred through the data path 21 that is routedthrough controller 12. There are many additional examples in which adata network can be actively managed by operating in the data path. Asdescribed above, fully operating in the data path can improve networkcontrol, but also significantly degrades forwarding performance of thesystem. Therefore, there is a need for a technique to operate on data inthe data path without significantly degrading the forwarding performanceof the system.

SUMMARY OF THE INVENTION

The present invention includes a method and apparatus for frame peekingthat enables a controller to operate on data in the data path withoutsignificantly degrading the forwarding performance of the system.According to an embodiment of the present invention, the system includesa controller, a forwarding engine for forwarding packets, and aninterface interconnecting the controller and the forwarding engine. Theinterface includes a subscribe/publish interface and a facility accessinterface. The subscribe interface allows the controller to request(subscribe) to receive a selected portion of a packet or packets of aflow. The publish interface allows the forwarding engine to publish therequested data to the controller. The facility access interface allowsthe controller to control packets stored in a buffer of the forwardingengine.

After the controller has subscribed to receive a portion of a packet, acopy of the portion of the received packet is provided to thecontroller. The controller may then analyze the received portion of thepacket to determine how the packet should be controlled. The controllercan then use the facility access interface to control the packet (e.g.,discard or block the packet, reschedule the forwarding of the packet,allow the packet to be forwarded normally). Therefore, because only aselected portion of a packet is provided to the controller, thecontroller can operate on the data without significantly degrading theforwarding performance of the system.

In addition, frame peeking can be used at an end-system to reduce thenumber of copies that are made of a packet in memory and improve packetprocessing efficiency. In traditional layered data retrieval, two copiesof a received packet must be made in memory. The end-system must firstcopy the packet into kernel memory and then determine which portion ofuser or application memory should receive the packet. The packet is thencopy from kernel space into the specific user memory space. Thus, twocopies must be made, thereby, creating additional packet processing anddelay. According to an embodiment of the present invention, theend-system includes an interface card for receiving packets, a processoror controller and memory. The controller requests or subscribes toreceive a portion of packets received at the interface card. Packets arereceived at the interface card and a portion of requested packets areprovided to the controller. The controller identifies a location tostore the packet in memory based on the portion of the packet. Thepacket is then stored in memory at the identified location. Thus,according to an embodiment of the present invention, only one copy ofthe packet is made in memory.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a system located at a node of a data network.

FIG. 2 illustrates a system located at a node of a data networkaccording to an embodiment of the present invention.

FIG. 3 is a flow chart illustrating the operation of the system of FIG.2 according to an embodiment of the present invention.

FIG. 4 illustrates a computer system operating as an end-systemaccording to an embodiment of the present invention.

DETAILED DESCRIPTION

Referring to the drawings in detail, wherein like numerals indicate likeelements, FIG. 2 illustrates a system at a node of a data networkaccording to an embodiment of the present invention. System 20 in FIG. 2includes a controller 22 for controlling operation of system 20, and aforwarding engine 24 for forwarding packets input on line 34 to othernodes via output line 36. System 20 can be implemented in hardwareand/or software. The packets can include Internet Protocol (IP) packets,Asynchronous Transfer Mode (ATM) application level frames (such as ATMAdaptation Layer frames) or the like. Control signals are input tocontroller 22 via line 38 and may be provided on a separate signalingconnection, but may also be in-band. Forwarding engine 24 also includesa buffer 26 for storing packets input via line 34.

An interface 28 couples controller 22 to forwarding engine 24. Interface28 includes a subscribe/publish interface 32 and a facility accessinterface 30. The subscribe/publish interface 32 allows controller 22 tosubscribe to request a predetermined portion of specific packets fromforwarding engine 24, and allows forwarding engine 24 to publish or sendthe requested portion of the packet to controller 22. Facility accessinterface 30 allows controller 22 to control the forwarding of thereceived packets. Interfaces 30 and 32 are described in greater detailbelow. A data network includes many nodes, where each node can include asystem 20.

System 20, according to an embodiment of the present invention, providesa mechanism for frame-peeking that enables controller 22 to peek at aportion of a requested packet. This frame-peeking mechanism enablescontroller 22 to only peek at parts of each requested packet as opposedto having to be fully in the data path. As a result, the frame-peekingmechanism of the present invention improves forwarding efficiency byreducing the amount of data routed through controller 22 (e.g., limitingbandwidth needs of controller 22) and by avoiding removing or copyingthe packet from the buffer 26 of forwarding engine 24. Moreover, an ATMswitch may support frame-peeking without performing reassembly andsegmentation of the full application level frame. In an IP router,packet-peeking limits the bandwidth from a kernel router located in theforwarding engine 24 to the flow controller at controller 22.

One of the benefits of interface 28 is that controller 22 maydynamically change the volume of data that goes through it. For example,during congestion, controller 22 may perform a selective discard ofselected packets. Initially, controller 22 may subscribe only to theflow statistics until buffer 26 fills up to a predetermined level offullness (indicating the onset of congestion) at which time controller22 starts peeking at the application level frames (e.g., subscribes to aportion of the frames or packets). By peeking at the incoming packets,controller 22 can then selectively discard the less important packetsusing facility access interface 30. Because only a small portion of thedata is copied to the controller 22, the volume of data going throughcontroller 22 is minimal. In this manner, controller 22 can operate onthe data without being fully in the data path.

According to an embodiment of the present invention, controller 22 canrequest (or subscribe) to peek into a particular group of packets ofinterest. Each group of packets is defined as a flow. According to anembodiment of the present invention, a flow is one or more packetssatisfying an equivalence relation. Typically, a flow can be identifiedby a common sequence of bits (i.e., a common bit pattern) in eachpacket. A wide variety of bit sequences can be used for flowidentification. For example, in a connection oriented network, such asan ATM network, a flow can be, for example, the group of ATM cells orapplication level frames corresponding to the ATM connection. ATM, forexample, allows for the flow (or connection) to be identified byinformation in the application level frame, such as part of an RTPframe. in a connectionless network, such as IP, a flow can be a group ofpackets or datagrams that are associated with each other. For example, aflow can include all IP packets from a specific IP address, or directedto a specific IP address, or having a predetermined prefix in the IPdestination address (e.g., all packets directed to England). IP version6 (IPv6) even provides a “flow label” for identifying flows of packetsor IP datagrams. In IP, a predetermined IP option can be used in a groupof packets to identify a flow. A flow could also include, for example,packets providing data of a particular type, such as MPEG-4 videopackets. In such case, the type of data (e.g., MPEG-4 video) carried inthe packet payload may be identified in the application level header inthe payload.

The subscribe/publish interface 32 allows controllers to subscribe to(request) events and information to be published (on request) byforwarding engine 24. According to an embodiment of the presentinvention, subscribe/publish interface 32 includes three primitives (orcommands) that allows controller 22 to subscribe (or request) to receivepacket information, and a primitive or command that allows theforwarding engine 24 to publish or provide the requested information tocontroller 22. The Subscribe primitives include:

Subscribe-Stats(flow identifier)—requests a subscription to simple flowstatistics, such as number of packets and bytes transmitted since lastinvocation, or the number of bytes (or packets) currently in the buffer26 using the subscribe-stats primitive. If the flow identifier is set to0, the controller 22 receives nodal statistics about buffer length andpacket loss rate.

Subscribe-Peek(flow identifier, offset, length)—implements frame peekingaccording to an embodiment of the present invention, allowing controller22 to subscribe to receive (peek at) a portion of requested packets.Subscribe-peek does not cancel subscription to statistics. Offset—is theoffset where peeking is to begin within the payload of the packet.Length—is the number of bytes to peek at, with 0 indicating all.

Subscribe-Ignore(flow identifier)—cancels all subscriptions.

The Publish interface includes at least one primitive:

Publish(flow identifier, packet reference, requested data)—this is usedby the forwarding engine 24 to publish the peek event, including thedata subscribed or requested by the controller 22. A publish message (orpublished peek event) is issued by forwarding engine 24 to controller22. The published peek event contains a flow identifier identifying theflow for the packet, a packet reference identifying the packet and acopy of the data from the packet (that was earlier requested orsubscribed to by controller 22). The packet reference may be used bycontroller 22 to manipulate the packet through facility access interface30, as described in greater detail below.

A controller can subscribe to particular packet data for one or moredifferent flows. Therefore, where a single controller 22 is used formultiple flows, a flow identifier is necessary in each publish message.However, as with all of the primitives described herein, the publishprimitive can be implemented in a variety of ways. For example, theremay be several controllers 22 within system 20, wherein each controller22 only monitors a single flow. In such a case, identification of theflow can be provided implicitly from forwarding engine 24 (rather thanexplicitly) because there is only one controller 22 for each flow.

Facility access interface 30 provides controller 22 with access to theresources of forwarding engine 24. Facility access interface 30 is usedby controller 22 to manipulate data flow. Some of the facility accessprimitives according to an embodiment of the present invention arelisted below.

The Facility Access Interface 30

Actions on flows (implicit argument: flow identifier):

I) Forwarding

Iblock(subset of input ports): blocks input on the subset of portsspecified. Arriving packets on these ports are discarded. Blocking isremoved on a port by excluding that port from the subset of a subsequentblock.

Oblock(subset of output ports): blocks output on the subset of portsspecified. Blocking is removed on a port by excluding that port from thesubset of a subsequent block.

Delay(Δ-time, subset of output ports): schedules arriving packets forforwarding at least Δ-time units after arrival, on the subset of portsspecified.

Actions on individual packets (implicit argument: packet reference):

Release-at(time, subset of output ports): schedules packet for departureon the subset of output ports specified.

Block(subset of output ports): blocks packet on the subset of outputports specified.

Discard( ): discards the packet, and removes it from the flow buffer.

Controller 22 can control packets via facility access interface 30.Controller 22 can control flows or individual packets. At the flowlevel, controller 22 can block packets on input ports or on outputports, or can schedule arriving packets of a flow for a delayed output.Controller 22 can similarly block or delay the output of individualpackets using a packet reference to identify each packet to be blockedor delayed. On connection oriented hardware (e.g., an ATM switch), theseprimitives would manipulate virtual circuit (VC) tables, whereas in aconnectionless router (e.g., an IP router), an output port is blocked.Therefore, controller 22 can control the fate of each packet enteringforwarding engine 24 without being fully in the data path. Controller 22can discard an individual packet, reschedule (delay) the transmission ofa packet, or can do nothing and allow the packet to be forwardednormally by forwarding engine 14. In contrast to an in-data-pathsolution, this set of primitives supports flow level connectivitymanagement without being fully in the data-path.

The operation of System 20 will now be described with reference to FIG.3. FIG. 3 is a flow chart illustrating the operation of system 20according to an embodiment of the present invention.

At Step 50, controller 22 requests (or subscribes) to receive apre-determined portion of packets corresponding to a particular flow.Controller 22 can subscribe to receive (peek-at) a portion of theincoming packets of an identified flow using the Subscribe-Peekprimitive or command, or other technique. The flow identifier argumentof the Subscribe-Peek command can be used to identify the flow (thegroup of packets of interest). The flow identifier argument can identifya flow using a variety of different bit sequences in each packet (e.g.,IP packets directed to a specified IP address, packets having a specificIPv6 “flow label”, a flow identification provided as a predetermined IPoption, an ATM VPI/VCI, header or other information identifying orclassifying the data in the payload). The offset argument identifies thenumber of bytes or bits offset from the beginning of the packet wherethe peeking shall begin, and the length argument identifies the numberof bytes to be provided to the controller 22.

At step 52, packets are received at forwarding engine 24 and stored inbuffer 26.

At step 53, forwarding engine 24 identifies the requested or subscribedpackets. In other words, forwarding engine 24 identifies receivedpackets that are part of the flow to which the peek-subscriptionapplies. This can be performed by analyzing each packet received byforwarding engine 24. For example, forwarding engine 24 can identify therequested packets by comparing a predetermined sequence of bits (e.g.,the IP address for the destination, or the IPv6 flow label, or headerinformation) in each packet with the flow identifier provided fromcontroller 22. A match indicates that the packet is part of the flowwhich has been subscribed to or requested by controller 22.

At step 54, a copy of the subscribed (requested) portion of eachidentified packet is provided with a packet reference from forwardingengine 24 to controller 22. This can be done using the publishprimitive, described above, or using another technique. For example, theforwarding engine 24 can interrupt the controller when a packet of thesubscribed flow is received (and the requested portion is available).Alternatively, the controller 22 can periodically poll the forwardingengine 24 and request to receive any portions of packets the controller22 previously subscribed.

For step 54, according to an embodiment of the present invention,forwarding engine 24 uses the offset and length arguments (provided inthe Peek-Subscribe message or primitive from controller 22) to identifythe beginning and length of the portion of the packet of interest. Theoffset can be provided relative to the start of a packet or frame orrelative to the start of a header (for some types of packets these twoare the same). This portion of the packet is then copied and placed in aPublish message that also includes the flow identifier (optional) and apacket reference. The flow identifier is the same as that provided bycontroller 22 (or a reference to that flow identifier). The packetreference is assigned by forwarding engine 24 and may indicate, forexample, a packet number (e.g., packet number 17). The Publish messageis then sent from forwarding engine 24 to controller 22. Therefore, itcan be seen that, rather than routing the entire packet from the buffer26 to controller 22, only the selected (subscribed) portion of thereceived packet and a packet reference (identifying the packet) isprovided to controller 22. This minimizes the amount of data passingthrough controller 22 and avoids degradation of the packet forwardingprocess.

At Step 56, controller 22 analyzes the received portion of the packet todetermine how the packet should be controlled (and even if the packetshould be controlled at all). For example, controller 22 can analyze theportion of the packet and determine that the packet stored in buffer 26is a low priority packet and should be discarded due to high congestion.

At Step 58, if controller 22 determines that the packet should becontrolled, controller 22 issues a command with a packet referenceidentifying the packet to forwarding engine 24 to indicate how thepacket should be controlled or manipulated. This can be done, forexample, via facility access interface 30. For example, if controller 22determines that, based on the received portion of the packet, the packetis a low priority and should be discarded, the discard primitive can beused by controller 22 to instruct forwarding engine 24 to discard thepacket. Controller 22 can issue many other types of messages or commandsto forwarding engine 24 to control the packet stored in buffer 26.

The frame peeking technique of the present invention can be applied tonodes (e.g., a router) in a network to improve forwarding performance.In addition, the frame peeking technique of the present invention canalso be applied to end-systems to improve efficiency in packetprocessing. Currently, end-systems (such as a user's personal computeror PC) include an interface card (e.g., Ethernet card with memory), aprocessor and main memory. When a packet is received and stored by theinterface card, the interface card issues an interrupt to the processor.The packet is then copied into kernel memory. The processor thenanalyzes the packet stored in kernel memory to determine its destination(user application). There may be one or more user applications currentlyrunning on the end-system that are receiving packets. After analyzingthe packet, the packet is then copied again into into user memory forthe user application. Thus, the end-system must make two copies of thepacket in main memory, causing additional delay.

According to an embodiment of the present invention, frame peeking canbe used at an end-system to avoid making two full copies of the packetin memory. FIG. 4 illustrates a computer system operating as anend-system. Computer system 70 includes an interface card 72, aprocessor 74 and memory 76. Processor 74 issues a subscribe-peek commandto interface card 72 identifying the portion of the specific packetsthat processor 74 would like to receive (peek), as described above. Thepackets are received and identified by the interface card 72 as part ofthe flow that is subscribed or requested by the processor 74. Thedesignated portion (e.g, indicated by offset and length arguments) ofthe packet is copied by interface card 72 and forwarded to processor 74along with a packet reference. The portion of the packet (and possiblythe packet reference) is then stored by processor 74 in kernel space ofmemory 76. Processor 74 then analyzes the stored portion of the packetto determine where the (complete) packet should be stored in memory 76(e.g., in which user space the packet should be stored). Processor 74then issues a store command with the packet reference to the interfacecard 72 to request a copy of the complete packet. Processor 74 receivesand then identifies the packet based on the packet reference and thenstores the packet in the identified user space in memory. This avoidsmaking two full copies of the packet in main memory, reducing processingtime.

The present invention includes a method and apparatus for frame peekingthat operates on data in the data path without significantly degradingthe forwarding performance of the system. According to an embodiment ofthe present invention, system 20 includes a controller 22 forcontrolling the system and a forwarding engine 24 for forwardingpackets. Interface 28 interconnects controller 22 and forwarding engine24. Interface 28 includes a subscribe/publish interface 32 and afacility access interface 30. The subscribe/publish interface 32 allowscontroller 22 to request (subscribe) to receive a selected portion ofpackets input to forwarding engine 24. The facility access interface 30allows controller 22 to control packets stored in buffer 26 offorwarding engine 24.

After controller 22 has subscribed to receive a portion of a packet, acopy of the requested portion of the received packet is provided tocontroller 22. Controller 22 then analyzes the received portion of thepacket to determine how the packet should be controlled. Controller 22may then use the facility access interface 30 to control the packet.Unlike previous techniques, the entire packet or flow is not routed tocontroller 22 for analysis. In this manner, controller 22 can operate onthe data without being fully in the data path. Accordingly, networkcontrol can be improved by operating on the data without degradingforwarding performance of the system. Moreover, in an ATM network,reassembly and segmentation are unnecessary because only a small portionof an ATM cell or application level frame is provided from forwardingengine 24 to controller 22, rather than the entire ATM cell orapplication level frame.

Several embodiments of the present invention are specificallyillustrated and/or described herein. However, it will be appreciatedthat modifications and variations of the present invention are coveredby the above teachings and within the purview of the appended claimswithout departing from the spirit and intended scope of the invention.For example, interface 28 provides merely one example of how controller22 and forwarding engine 24 can communicate to perform frame-peeking.There are many other ways to provide communication between controller 22and forwarding engine 24.

What is claimed is:
 1. A method of peeking into a portion of a packetreceived at a system in a data network, the system including a receivingsection and a control section, said method comprising the steps of:receiving a plurality of packets at the receiving section of the system;selecting one of said received packets; copying a portion of theselected packet; providing the copied portion of the selected packet tothe control section of the system; and the control section issuing arequest message to the.receiving section that requests to receive aportion of each of a group of packets received at the receiving station,the request message identifying the group of packets and the portion ofeach packet.
 2. The method of claim 1 and further comprising the stepsof: analyzing the copied portion of the packet; and controllingforwarding of the packet based on said step of analyzing.
 3. The methodof claim 1 wherein said step of the control section issuing a requestcomprises the step of the control section issuing a request message tothe receiving section identifying the packet and a length and offset. 4.The method of claim 1 wherein said request message identifies the groupof packets using a common sequence of bits in each packet.
 5. The methodof claim 1 wherein said group of packets each satisfies an equivalencerelation, said group of packets comprising a flow.
 6. The method ofclaim 4 wherein said common sequence of bits comprises a flow identifierfor identifying a flow, said flow comprising the group of packets. 7.The method of claim 4 wherein said common sequence of bits comprises anIPv6 flow label.
 8. The method of claim 4 wherein said common sequenceof bits comprises at least a portion of an address.
 9. The method ofclaim 4 wherein said common sequence of bits comprises an IP option. 10.The method of claim 4 wherein said common sequence of bits comprises aportion of a packet header.
 11. The method of claim 4 wherein saidpacket comprises an Internet Protocol (IP) packet.
 12. The method ofclaim 1 wherein said packet comprises an ATM frame.
 13. The method ofclaim 1 wherein said packet comprises a plurality of ATM cells.
 14. Themethod of claim 1 wherein said control section comprises a controllerand said receiving section comprises a forwarding engine.
 15. The methodof claim 1 wherein said step of providing comprises the step ofproviding the copied portion of the selected packet and a packetidentifier to the control section of the system.
 16. The method of claim1 wherein said step of providing comprises the step of providing thecopied portion of the selected packet and a packet identifier to thecontrol section of the system for controlling or manipulating thepacket.
 17. The method of claim 1 and further comprising the steps of:analyzing the requested portion of the packet; and identifying alocation in memory to store the packet.
 18. The method of claim 17 andfurther comprising the steps of: receiving the packet; storing thepacket at the identified location in memory.
 19. A method of peekinginto a portion of one or more packets of a flow for controlling theforwarding of the packets, the method comprising the steps of: sending arequest message from a controller to a forwarding engine to request aportion of each packet of a flow received at the forwarding engine, therequest message identifying the flow and the portion of each packet;receiving at the forwarding engine one of the packets corresponding tothe flow; storing the received packet; identifying that the receivedpacket corresponds to the flow; sending a copy of the portion of theidentified packet from the forwarding engine to the controller forcontrolling forwarding of the packet; identifying a location in memoryto store the identified packet based on said portion of the identifiedpacket; sending the identified packet to the controller; and storing theidentified packet at the identified location in memory.
 20. A method ofpeeking into a portion of one or more packets of a flow for controllingthe storing of the packets, the method comprising the steps of: sendinga request message from a controller to an interface to request a portionof each packet of a flow received by the interface, the request messageidentifying the flow and the portion of each packet; receiving at theinterface one of the packets corresponding to the flow; storing thereceived packet in the interface; identifying that the received packetcorresponds to the flow; sending a copy of the portion of the identifiedpacket from the interface to the controller for controlling forwardingof the packet; identifying a location in memory to store the identifiedpacket based on said portion of the identified packet; sending theidentified packet to the controller; and storing the identified packetat the identified location in memory.
 21. The method of claim 20 whereinsaid controller and interface are located at an end-system.
 22. Anapparatus at a node for peeking into a portion of a frame comprising: acontroller; a forwarding engine receiving a plurality of unmodifiedpackets as an input and forwarding the packets under control of thecontroller; an interface controller coupling the controller and theforwarding engine, the interface allowing the controller to request acopy from the forwarding engine of a portion of an unmodified packetreceived by the forwarding engine and allowing the forwarding engine tosend the portion of the requested packet from the forwarding engine tothe controller; and wherein said controller comprises a plurality ofcontrollers, each said controller for controlling the forwarding of adifferent group of packets.
 23. The apparatus of claim 22 wherein saidinterface further allows the controller to control the forwarding of therequested packet based on the received portion of the requested packet.24. The apparatus of claim 22 wherein said controller comprises aplurality of controllers, each said controller for controlling theforwarding of a different group of packets.
 25. A method of peeking intoa portion of a packet received at a system in a data network, saidmethod comprising the steps of: receiving a plurality of packets at areceiving section of the system; selecting one of said received packets;copying a portion of the selected packet; providing the copied portionof the selected packet to a control section of the system; and receivinga request message from the control section requesting to receive aportion of each of a group of packets received at the receiving station,the request message identifying the group of packets and the portion ofeach packet.
 26. A method of peeking into a portion of a packet receivedat a system in a data network, said method comprising the steps of:issuing a request message, from a control section, to a receivingsection that receives a plurality of packets; wherein said requestmessage including a request to: receive a portion of each of a group ofpackets received at the receiving section; select one of said receivedpackets; copy a portion of the selected packet; and provide the copiedportion of the selected packet to the control section of the system; andwherein said request message identifying the group of packets and theportion of each packet.